feat: Worker 进程拆分（F20）

- 新增 worker 进程入口（npm run worker）只跑作业不监听端口
- trialrun compose 增加 worker profile（server 可 JOBS_ENABLED=false）
- 更新 runbook/.env.example/README 说明与 v3 CSV 状态推进

deploy/trialrun/docker-compose.yml

@@ -64,6 +64,44 @@ services:
     volumes:
       - ./data/storage:${STORAGE_DIR}
 
+  worker:
+    build:
+      context: ../..
+      dockerfile: deploy/trialrun/Dockerfile
+    container_name: hyb-oa-trialrun-worker
+    restart: unless-stopped
+    profiles: ["worker"]
+    depends_on:
+      db:
+        condition: service_healthy
+    command: ["npm", "run", "worker"]
+    environment:
+      NODE_ENV: production
+      APP_ORIGIN: ${APP_ORIGIN}
+      JWT_SECRET: ${JWT_SECRET}
+      DATABASE_URL: ${DATABASE_URL}
+      STORAGE_DIR: ${STORAGE_DIR}
+      SERVE_CLIENT_DIST: "false"
+      CLIENT_DIST_DIR: ${CLIENT_DIST_DIR}
+
+      OCR_PROVIDER: ${OCR_PROVIDER}
+      OCR_MAX_ATTEMPTS: ${OCR_MAX_ATTEMPTS}
+      OCR_POLL_CRON: ${OCR_POLL_CRON}
+      OCR_BATCH_SIZE: ${OCR_BATCH_SIZE}
+      OCR_LOCK_TTL_SECONDS: ${OCR_LOCK_TTL_SECONDS}
+      OCR_TIMEOUT_MS: ${OCR_TIMEOUT_MS}
+      TENCENT_SECRET_ID: ${TENCENT_SECRET_ID}
+      TENCENT_SECRET_KEY: ${TENCENT_SECRET_KEY}
+      TENCENT_OCR_REGION: ${TENCENT_OCR_REGION}
+
+      DELEGATION_REVOKE_CRON: ${DELEGATION_REVOKE_CRON}
+
+      JOB_DRIVER: ${JOB_DRIVER}
+      JOBS_ENABLED: "true"
+      PG_BOSS_SCHEMA: ${PG_BOSS_SCHEMA}
+    volumes:
+      - ./data/storage:${STORAGE_DIR}
+
   init:
     build:
       context: ../..